The present invention relates to a method for the encryption of information being transferred between data communication devices in a data communication system wherein one or more data frames are formed from one or more data packets formed from the infomation by an application, and these data frames comprise at least a header field and a data field. The invention relates additionally to a data communication system which comprises the means for the encryption of information being transferred between data transfer devices, the means for forming one or more data packets from the information and the means for forming data frames from the data packets.
Data transfer between separate data transfer devices can be achieved in such a way that those data transfer devices between which data at that time is to be transferred, are linked together for the time needed for the data transfer. In such a case, the link is maintained until the user stops the data transfer. In such cases, most part of the linkage time is spent in entering commands provided by the user and only a small part of the time is actual data transfer. This limits, for example, the maximum number of simultaneous users. Another possibility is to exploit a so-called packet switched data transmission. In this case, data is transferred between data transfer devices in a packet mode, in which case the time between the packets is freely available and can be used by other data transfer devices. In this case, the number of simultaneous users can be increased, especially in wireless data transfer networks, such as cellular networks, since in this case the mobile stations which are in the same cellular area can use the same transfer channel. One such a cellular system is the GSM system (Group Special Mobile) for which a packet mode data transfer service GPRS (General Packet Radio Service) has been developed. FIG. 1 shows a block diagram of principal blocks in the operation of the GPRS system. A packet switching controller SGSN (Serving GPRS Support Node) controls the operation of packet switching service on the cellular network side. The packet switching controller SGSN controls the sign-on and sign-off of the mobile station MS, the updating of the location of the mobile station MS and the routing of data packets to their correct destinations. The mobile station MS is connected to the base station subsystem BSS through a radio interface Um (FIG. 1). The base station subsystem is connected to the packet switching controller SGSN through the BSS-SGSN interface Gb. In the base station subsystem BSS, the base station BTS and the base station controller BSC have been connected to each other by a BTS-BSC interface Abis. The location of the packet switching controller SGSN in the mobile station network can vary, for example, according to which technical implementation is being used. Although in FIG. 1, the packet switching controller SGSN has been marked outside the base station subsystem BSS, the packet switching controller SGSN can be placed, for example, as a part of the base station BTS connected to the base station subsystem BSS or as a part of the base station controller BSC.
The GPRS system has been described, for example, in draft proposals GSM 01.60, GSM 02.60, GSM 03.60 and GSM 04.60 which have been dated prior to the application date of the present invention.
The operation of both the mobile station MS and the packet switching controller SGSN can be divided into various layers, each providing a different function, as has been shown in FIG. 2. The International Standardisation Organisation, ISO, has formulated an OSI model (Open Systems Interconnection) for grouping data transfer into different functional layers. In this model, there are seven layers which are not necessarily needed in all data communication systems.
Transferable information, such as control signalling and data transmitted by the user, between a mobile station MS and a packet switching controller SGSN is exchanged preferably in a data frame mode. The data frame of each layer consists of a header field and a data field. FIG. 2 shows also the structure of data frames being used in the GPRS system in different layers.
The information contained in the data field can be, for example, data entered by the user of the mobile station or signalling data. The data field may contain confidential information which has to be secured as reliably as possible before transmitting it to the radio path. In such a case, the encryption has to be executed in such a way that in all simultaneous connections between the packet switching controller SGSN and mobile stations MS connected to it, a separate encryption key is used. Conversely, it is not preferable to cipher the address data of the data frame by the same encryption key used in the ciphering of the data field, since mobile stations MS use a shared radio path resource, i.e. information in many different connections is transferred in the same channel, for example, at different time intervals. In this case, each mobile station should receive all messages transmitted in the channel concerned and decrypt at least the encryption of the address data to identify to which mobile station the message is intended. Also the packet switching controller SGSN does not know which encryption key should be used.
In the following, the operational functions of the layers of the GPRS system have been presented.
The lowest layer is called an MAC layer (Media Access Control) which controls the use of the radio path in the communication between the mobile station MS and the base station subsystem BSS, such as allocating channels for transmitting and receiving packets.
Data transmission between the base station subsystem and the packet controller SGSN in the lowest level is executed at the L2 layer (link layer) in which link layer protocol is used, such as LAPD protocol according to standard Q.921, frame relay protocol or the equivalent. The L2 layer may additionally contain also quality or routing data according to GPRS specifications. Layer L2 has properties of the physical layer and the link layer of the OSI model. The physical transmission line between the base station subsystem BSS and the packet controller SGSN depends, for example, on where the packet controller SGSN has been located in the system.
Above the MAC layer, there is an RLC layer (Radio Link Control) and its function is to divide the data frames formed by the LLC layer into fixed sized packets to be transmitted to the radio path and their transmission and retransmission when necessary. The length of the packets in the GRPS system is the length of one GSM time slot (approximately 0.577 ms).
LLC layer (Logical Link Control) provides a reliable transmission link between the mobile station MS and the packet controller SGSN. The LLC layer, for example, adds to the transmitted message error checking data by means of which it is intended to correct those uncorrectly received messages and when necessary, the message can be retransmitted.
SNDC layer (Sub-Network Dependent Convergence) comprises functions like protocol conversions of transmitted information, compression, segmentation and segmentation of messages coming from the upper layer. Additionally, ciphering and deciphering are accomplished at the SNDC layer. The structure of the SNDC frame has been presented also in FIG. 2. The SNDC frame comprises an SNDC header field (SNDC header) and an SNDC data field (SNDC data). The SNDC header field consists of protocol data (Network Layer Service access point Identity, NLSI) and of SNDC control data, such as determinations of compression, segmentation and ciphering. The SNDC layer functions as a protocol adapter between protocols used at the upper level and the protocol of the LLC layer (link layer).
The transmitted information comes preferably as data packets to the SNDC layer from some application, such as messages according to the GPRS system or packets of the Internet protocol (IP). The application can be, for example, a data application of a mobile station, a telecopy application, a computer program which has a data transmission link to a mobile station, etc.
The MAC layer, RLC layer, LLC layer and the L2 layer contain properties which are described at layer 2 in the OSI model. The above mentioned layers and the layers described in the OSI model are not, however, distinctly coherent.
The SNDC frame is transferred to the LLC layer where an LLC header field is added to the frame. The LLC header field consists of a Temporary Logical Link Identity (TLLI) and an LLC control part. The packet controller GPRS establishes a TLLI identity for each data transmission link between a mobile station MS and a packet controller GPRS. This data is used in data transmission for defining which data transmission link each message belongs to. Simultaneously, the same TLLI identity can only be used in one data transmission link. After the termination of the link, the TLLI identity used in the link can be allocated to a new link to be subsequently formed. The LLC control part defines the frame number and the command type (info, acknowledge, retransmission request etc.) for ensuring an error free data transfer.
Ciphering in the GSM system is executed at the physical layer as a bit per bit ciphering, i.e. bit stream transmitted to the radio path is formed by summing to the transmitted data ciphering bits which are formed by using algorithm A5 known per se, by using a ciphering key Kc. Algorithm A5 ciphers transmitted data and signalling information at the physical layer on the channels dedicated to data transfer (Traffic Channel, TCH or Dedicated Control Channel, DCCH).
Synchronization of transmitted messages is ensured in such a way that algorithm 5 is driven by means of a special synchronization data (COUNT). The synchronization data COUNT is formed on the basis of a TDMA frame number. Then the contents of each 114-bit block formed by algorithm A5 depend only on the frame numbering and the ciphering key Kc.
The setting of the ciphering key Kc is most preferably executed at the stage when the communication traffic of the dedicated channel has not yet been encrypted and the mobile station network being used has identified the mobile station MS. In the identification in the GSM system, an International Mobile Subscriber Identity, IMSI, is used which identifies the mobile station and which has been stored in the mobile station, or a Temporary Mobile Subscriber Identity, TMSI, is used which has been formed on the basis of the subscriber identity. In a mobile station, also a subscriber identification key, Ki, has been stored. The subscriber identification key Ki is also known by the mobile station network.
To ensure that the ciphering key Kc is known only by the mobile station MS and the mobile station network, the transmission of the ciphering key from the base station subsystem BSS to the mobile station MS is indirect. Then, in the base station subsystem BSS, a Random Access Number, RAND, is formed which is transmitted to the mobile station MS. The ciphering key Kc is formed from the random access number RAND and from the subscriber identification key Ki by using algorithm A8, as has been shown in FIG. 3. The calculation and storing of the ciphering key Kc are executed both in the mobile station MS and in the mobile station network.
Data transfer between the mobile station MS and the base station subsystem BSS is nonciphered at the start of the connection. The transition to the ciphered mode proceeds preferably in such a way that the base station subsystem BSS transmits to the mobile station a certain command (unciphered) which in this context is called the "start cipher". After the mobile station MS has received the command "start cipher", it starts the enciphering of the transmitted messages and deciphering of the received messages. Correspondingly, the base station subsystem BSS starts the enciphering of messages transmitted to the mobile station after the base station subsystem has received the ciphered message transmitted by the mobile station and deciphered the ciphering correctly.
In the above described ciphering, the synchronization was based, for example, on the TDMA frame numbering of the physical layer. It is not possible to use it in all applications, particularly when information belonging to different connections is transmitted on the same channel, such as in packet switched data transmission methods.
In the European patent application EP-0 689 316, a method has been presented for the encryption of data transfer wherein, for example, encryption data which comprises an encryption key is attached to the transmitted data frames. A U.S. Pat. No. 5,319,712 comprises a method and equipment for the encryption of data transfer so that a sequence number is attached to the data frames of the link layer and the data frame is ciphered. A disadvantage of these ciphering methods according to the prior art is, for example, that the receiver does not know without deciphering, to whom the received data frame is intended, in which case the unnecessary reception of data frames and deciphering causes a deterioration in the efficiency of the system.